Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds components.properties filtering in bom #373

Draft
wants to merge 4 commits into
base: master
Choose a base branch
from

Conversation

timmyteo
Copy link
Contributor

Implements #362

Filters the desired components.properties objects by name. This implementation uses an exclude list instead of an allow list. Filtering is applied to the file sbom-universal.vdr.json

Attached are before and after bom files to demonstrate filtering in action on an example. In this example, the bom only had the property "ImportedModules"
after.json
before.json

Signed-off-by: Tim Messing <[email protected]>
Signed-off-by: Tim Messing <[email protected]>
@prabhu prabhu requested a review from cerrussell November 16, 2024 21:51
depscan/cli.py Outdated
bom_data["vulnerabilities"] = pkg_vulnerabilities
json_dump(vdr_file, bom_data, error_msg=f"Unable to generate VDR file at {vdr_file}", log=LOG)


def remove_extra_properties(bom_data):
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@timmyteo Could we refactor this to simplify?

exclude_properties = {"Namespaces", "ImportedModules"}
for i, component in enumerate(bom_data["components"]):
    if properties := component.get("properties"):
         bom_data["components"][i]["properties"] = [p for p in properties if p.get("name") not in exclude_properties]
return bom_data

@prabhu Do we want to make the excluded or allowed properties an optional argument for this function?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Optional argument sounds good. Support for regex or startswith since blint uses "internal:" prefix

@timmyteo
Copy link
Contributor Author

@prabhu - I have added regular expression matching for exclusion and made the feature controlled by an optional argument to the command line.

@cerrussell - Thanks for the simplified code! If you see a way of further simplifying the new logic added for the regular expression matching, please let me know.

@prabhu
Copy link
Member

prabhu commented Nov 18, 2024

@timmyteo Thank you for the improvements. I am not convinced about a cli argument specifically for this. Perhaps, this could be part of some profile with some trimming happening by default. Let me include these changes in a new PR, since I am also planning to do some refactoring.

@prabhu prabhu marked this pull request as draft November 18, 2024 16:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants